On October 20, 2026, one of the most serious cyber vulnerabilities ever identified was announced, found in the underlying PHP language in most websites. While patches were quickly released, millions of hacker attacks have been underway around the world since the news broke. Expert tells Fanpage.it that the attempts will continue for weeks. The risks are significant.
The world of cybersecurity is in turmoil after the discovery of two critical flaws In the code of PHPa very widespread programming language and the basis of the vast majority of websites. It is estimated that around 70 percent are involved, also thanks to the extreme diffusion of CMS WordPressused for both large institutional portals than in smaller personal projects. It all started on Tuesday 20 October, when the news of the very serious IT vulnerabilities began to circulate on the forum Hacker News. The two flaws, named individually CVE-2026-109618 And CVE-2026-109619 and as a couple PHP2Shellwere independently identified by two companies: the Californian cybersecurity company Califthanks to the work of Ryan Austin conducted in the context of the project OpenAI “Patch the Planet”; and the cloud security company Wizwhich is part of the Google company Alphabet Inc. and Google Cloud (in recent days involved in a massive downturn).
To identify the “historic” flaw that has been present in the software for a decade, the two groups used two powerful artificial intelligence models: GPT-5.6 Sol of OpenAI e Gemini 4 Argon by Google. These AIs have the ability and speed to identify flaws in a short time, while a human could spend years of work. In reality, concerns about the security of PHP have been there for years, however the researchers were not available exploit specific entities capable of exploiting the problems encountered did not consider the problem significant. But something changed dramatically with the discovery of PHP2Shell, which Austin claimed to be the most serious vulnerability ever foundcapable of compromising the security of millions of websites. Essentially, with these vulnerabilities criminals can take control of the web servers involved, a clear path to easily steal i sensitive data of people and institutions. No wonder some talk about risks to national security.
Since the discovery of the flaws was announced, there has been a real earthquakewith the immediate closure of institutional and non-institutional sites to prevent attacks. There have been literally millions of illicit login attempts since this story began circulating. Among the most significant cases is that of Cloudflare: As stated in a post on X by the CEO Matthew Princein the first minutes there were tens of thousands, they went to hundreds of thousands in a couple of hours and jumped to millions to date. The entire internet has been literally bombarded with attempts to extort sensitive information for a couple of days. Heads of government and national cybersecurity agencies – such as the National Security Agency – intervened directly on the issue, with the invitation to immediately install the corrective patches (published on October 21st by the PHP Foundation on Github). In the meantime, for those who don’t know how to update their portal, it has been recommended to send it offline. Among the pages and sites disconnected from the network are those of the Finnish, Scottish and Dutch governments, but also important health organizations, online newspapers and many others.
The fix patch is for the versions of PHP 8.2, 8.3, 8.4 and 8.5although the vulnerabilities have been present since 5.4. In this case, however, they are considered obsolete for the modern web and therefore were not involved in the intervention. The main problem with the PHP2Shell vulnerability lies in the fact that not everyone has become aware of the problem or is able to solve it on their own. It is no coincidence that cybersecurity experts expect massive hacker attacks for some time.
“It’s a huge flaw”said a cybersecurity expert to Fanpage.it. “Patches that resolve the problem have already been released, but thousands of small and medium-sized sites and services will suffer the consequences for weeks. For most important institutional and commercial entities, the application of patches is the responsibility of those who provide the service and has the infrastructure used by the company or the state in its hands, but for thousands of sites the owner himself must provide it”, continues the expert, who also had to apply the patch on his portal.
“And who isn’t capable? What guarantees do those who leave technical management to the provider’s automation have? How long will it be before they automatically patch him? Who informs these people? Because not everyone follows Tech news or similar“, the computer scientist comments with concern. In essence, even if the vulnerability was quickly blocked, there is still a plethora of sites and related sensitive data ready to be plundered by ill-intentionedin the context of one of the most serious cybersecurity crises in recent years.
